build status Coverage Status Version

pbkdf2-sha256 is a JavaScript implementation of PBKDF2 using the SHA256 HMAC. It's useful as the Scrypt algorithm uses this. It's fully compatible with Node.js and the browser (via Browserify).

Package Info


This is useful for the Scrypt algorithm.

Why not just use the Node.js pbkdf2 function? The Node.js pbkdf2 function uses the sha1 algorithm and not the sha256 algorithm for its pseudorandom function. This will change when Node v0.12 is released. Until then, this is the next best option.


npm install --save pbkdf2-sha256


var pbkdf2 = require('pbkdf2-sha256')

var key = 'passwd'
var salt = 'salt'
var res = pbkdf2(key, salt, 1, 64);
console.log(res.toString('hex')) // => 55ac046e56e3089fec1691c22544b605f94185216dde0465e68b9d57c20dacbc49ca9cccf179b645991664b39d77ef317c71b845b1e30bd509112041d3a19783


pbkdf2(key, salt, iterations, keyLenBytes)

Returns Buffer.


Alternative Implementations

Why didn't I use either one of these? They're not Node.js optimized. They also don't use native types, so they'll be slower in the browser.